terse-self-host
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npx create-terseand installsterse-cliglobally usingnpm install -g. These operations run scripts and install software that affects the global system environment. - [PERSISTENCE_MECHANISMS]: The skill uses the
terse target usecommand to modify the user's shell configuration files (~/.zshrcor~/.bashrc) by appending export blocks. This is used to persist CLI target settings across terminal sessions. - [DATA_EXPOSURE]: The instructions guide the user and agent to manage sensitive information, including
JWT_SECRET,LOCAL_SECRETS_ENCRYPTION_KEY, and various OAuth Client Secrets (Gmail, GitHub, Slack, etc.) within a.envfile located in the installation directory. - [EXTERNAL_DOWNLOADS]: The bootstrap process pulls approximately 500MB of Docker images from Google Artifact Registry (
us-central1-docker.pkg.dev). These are official images for the platform's backend, frontend, and database services.
Audit Metadata